C#: Add flow steps from a PageModel to cshtml page. #15039
Conversation
| /** Gets a handler method such as `OnGetAsync` */ | ||
| Method getAHandlerMethod() { | ||
| result = this.getAMethod() and | ||
| result.getName().matches("On%") and |
There was a problem hiding this comment.
Should OnPageHandler% methods be filtered out?
There was a problem hiding this comment.
Hmm, I guess those methods are not technically handler methods; however they are called during the page handler process, so it makes sense to consider tainted writes to the model in those methods to still propagate to the page.
|
|
||
| from DataFlow::Node source, DataFlow::Node sink | ||
| where TestXss::flow(source, sink) | ||
| select sink, source, sink, "Xss" |
There was a problem hiding this comment.
I suggest making this a path-problem query instead.
| private MethodCall getImplicitThisCallInVoidHandler(PageModelClass pm) { | ||
| result.getEnclosingCallable() = pm.getAHandlerMethod() and | ||
| result.getEnclosingCallable().getReturnType() instanceof VoidType and | ||
| result.hasImplicitThisQualifier() |
There was a problem hiding this comment.
Why only implicit this qualifiers?
| PageModelClass pm; | ||
|
|
||
| PageModelJumpNode() { | ||
| this.asExpr() = [getAPageCall(pm), getImplicitThisCallInVoidHandler(pm)].getQualifier() |
There was a problem hiding this comment.
For the getImplicitThisCallInVoidHandler case, I would expect that the node should be the post-update node, as that is what is that target of stores. I.e., in this.Name = source() the store is into the post-update node for this.
Adds flow steps from
PageModelhandler methods (calls toPageModel.Page()andPageModel.RedirectToPage()as well as implicit flow fromthisin void-returning handler methods) to theModelfield in the code generated from the.cshtmlfile for the corresponding page.